refactor(release): reuse the shared win-exec launcher

The release script carried its own copy of the Windows shim resolution that
src/lib/win-exec.ts already owns. Two copies of the same PATHEXT reasoning drift
apart, and this one sits in the preflight that runs before anything else, so a
divergence there aborts a release before a single command executes.

Behaviour is unchanged; the logic now has one home.

Author: lidge-jun

scripts/release.ts

@@ -17,6 +17,7 @@
  * Requires: gh CLI (authed). Publishing is tokenless via Trusted Publishing (OIDC) — no NPM_TOKEN.
  */
 import { $ } from "bun";
+import { commandInvocation } from "../src/lib/win-exec";
 
 const args = process.argv.slice(2);
 interface GhRun {
@@ -39,30 +40,22 @@ const SERVICE_WORKFLOW = "service-lifecycle.yml";
 const CI_WAIT_TIMEOUT_MS = 20 * 60 * 1000;
 const CI_POLL_MS = 10 * 1000;
 
-/**
- * On Windows, `npm`, `gh`, and `git` are usually `.cmd`/`.exe` shims rather than
- * bare files on PATH. `Bun.$` resolves those, but `Bun.spawn` does not: it looks
- * for a literal `npm` and fails. The preflight below is the FIRST thing the
- * release runs, so that mismatch aborted the script before a single shim was
- * invoked — which is why the release-helper tests saw exit 1 and an empty call
- * log on windows-latest while every other platform passed.
- *
- * `.cmd` is tried ahead of `.exe` because that is what npm and gh actually ship
- * on Windows; a real `.exe` (git) still resolves through PATHEXT lookup below.
- */
-function resolveCommandForPlatform(command: string[]): string[] {
-  if (process.platform !== "win32") return command;
-  const [bin, ...rest] = command;
-  if (!bin || bin.includes("\\") || bin.includes("/") || /\.[a-z]+$/i.test(bin)) return command;
-  for (const extension of [".cmd", ".exe", ".bat"]) {
-    const resolved = Bun.which(`${bin}${extension}`);
-    if (resolved) return [resolved, ...rest];
-  }
-  return [Bun.which(bin) ?? bin, ...rest];
-}
-
 async function runQuiet(command: string[]): Promise<CommandResult> {
-  const proc = Bun.spawn(resolveCommandForPlatform(command), { stdout: "pipe", stderr: "pipe" });
+  // Windows exposes npm and gh as `.cmd` shims. A shell-less spawn of a bare
+  // `npm` skips PATHEXT entirely and refuses `.cmd` targets outright, so this
+  // preflight — the first thing a release does — aborted before invoking a
+  // single command, and the release-helper tests saw exit 1 with an empty call
+  // log. `commandInvocation` is the module the CLI already uses for exactly
+  // this, escaping included; do not hand-roll a second resolver here.
+  const [bin, ...rest] = command;
+  const invocation = commandInvocation(bin ?? "", rest);
+  const proc = Bun.spawn([invocation.file, ...invocation.args], {
+    stdout: "pipe",
+    stderr: "pipe",
+    // Load-bearing on the `cmd.exe /d /s /c` path: the invocation is already a
+    // fully escaped command LINE, so re-quoting it would corrupt the arguments.
+    ...(invocation.options.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
+  });
   const [stdout, stderr, exitCode] = await Promise.all([
     new Response(proc.stdout).text(),
     new Response(proc.stderr).text(),

tests/release-helper.test.ts

@@ -4,6 +4,7 @@ import { spawnSync } from "node:child_process";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { commandInvocation } from "../src/lib/win-exec";
 
 setDefaultTimeout(30_000);
 
@@ -216,7 +217,10 @@ describe("release helper", () => {
   test("preflight runs typecheck, test suite, and privacy scan before version bump on main dry-runs", () => {
     const { calls, result } = runRelease("9.9.9");
 
-    expect(result.status).toBe(0);
+    // Report what the script actually said. A bare status assertion turned a
+    // Windows-only spawn failure into "Expected: 0 Received: 1" with no cause,
+    // which cost a full CI round to diagnose.
+    expect(`${result.status}\n${result.stderr ?? ""}`.trim()).toBe("0");
 
     const typecheckIndex = findCallIndex(calls, "bun", call => call.args.join(" ") === "x tsc --noEmit");
     const testIndex = findCallIndex(calls, "bun", call => call.args.join(" ") === "test --isolate tests");
@@ -282,4 +286,39 @@ describe("release helper", () => {
     expect(result.stderr + result.stdout).toContain("moved while waiting for CI");
     expect(findCallIndex(calls, "gh", call => call.args[0] === "workflow" && call.args[1] === "run")).toBe(-1);
   });
+
+  /**
+   * The preflight's `runQuiet` callers (`npm view`, `git ls-remote`, `gh release
+   * view`) are the first commands a release runs. On Windows they are `.cmd`
+   * shims, and a shell-less spawn of a bare `npm` neither consults PATHEXT nor
+   * accepts a `.cmd` target — so the script died before invoking anything and
+   * the four tests above failed with an empty call log on windows-latest only.
+   *
+   * The rest of this suite runs on the host platform, so on macOS/Linux it can
+   * never exercise that path. Pin the win32 resolution directly instead of
+   * waiting for CI to tell us.
+   */
+  test("preflight commands resolve through the Windows .cmd launcher", () => {
+    const env = { PATH: "C:\\shims", PATHEXT: ".COM;.EXE;.BAT;.CMD" };
+    const cmdShim = (name: string) => (path: string) => path.toLowerCase() === `c:\\shims\\${name}.cmd`;
+
+    const npm = commandInvocation("npm", ["view", "pkg@9.9.9", "version"], "win32", { env, exists: cmdShim("npm") });
+    expect(npm.file).toBe("cmd.exe");
+    expect(npm.options.windowsVerbatimArguments).toBe(true);
+    expect(npm.args.join(" ")).toContain("npm.cmd");
+    // A bare name would have survived unresolved and ENOENT'd at spawn time.
+    expect(npm.args.join(" ")).not.toBe("npm");
+
+    const gh = commandInvocation("gh", ["release", "view", "v9.9.9"], "win32", { env, exists: cmdShim("gh") });
+    expect(gh.file).toBe("cmd.exe");
+    expect(gh.args.join(" ")).toContain("gh.cmd");
+
+    // A real `.exe` (git) must NOT be wrapped: direct spawn keeps arg boundaries.
+    const git = commandInvocation("git", ["ls-remote", "origin"], "win32", {
+      env,
+      exists: (path: string) => path.toLowerCase() === "c:\\shims\\git.exe",
+    });
+    expect(git.file.toLowerCase()).toBe("c:\\shims\\git.exe");
+    expect(git.options.windowsVerbatimArguments).toBeUndefined();
+  });
 });